#csaf

#OT #Advisory VDE-2026-065 Endress+Hauser: iDTM Debug Interface Vulnerability in the FDI Package Library A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory. #CVE CVE-2026-9593 https://certvde.com/en/advisories/vde-2026-065/ #CSAF https://endress-hauser.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-065.json

#OT #Advisory VDE-2026-008 Phoenix Contact: Multiple vulnerabilities in the firmware of CHARX SEC3xxx charging controllers Multiple vulnerabilities have been identified in the firmware of CHARX SEC-3xxx EV charging controllers, including the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models. The flaws could allow attackers to compromise the devices remotely, resulting in a complete loss of confidentiality, integrity, and availability. #CVE CVE-2026-7849, CVE-2026-44108, CVE-2026-44104, CVE-2026-44101, CVE-2026-44090, CVE-2026-44100, CVE-2026-44092, CVE-2026-44091, CVE-2026-44098, CVE-2026-44094, CVE-2026-44106, CVE-2026-44099, CVE-2026-44096, CVE-2026-44095, CVE-2026-44093, CVE-2026-44107, CVE-2026-44097, CVE-2026-44105, CVE-2026-44103, CVE-2026-44102 https://certvde.com/en/advisories/vde-2026-008/ #CSAF https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-008.json

#OT #Advisory VDE-2026-041 CODESYS PROFINET Controller - Out-of-bounds Write CODESYS PROFINET is an add‑on for the CODESYS Development System that provides a fully integrated PROFINET protocol stack along with diagnostic capabilities. When a PROFINET Controller is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems. #CVE CVE-2026-35226 https://certvde.com/en/advisories/vde-2026-041/ #CSAF https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-06_vde-2026-041.json

#OT #Advisory VDE-2026-085 Weidmueller: SQL Injection Vulnerability in PROCON-WEB SCADA A remote unauthenticated attacker can exploit a SQL injection vulnerability in PROCON-WEB SCADA to execute arbitrary commands. #CVE CVE-2026-16462 https://certvde.com/en/advisories/vde-2026-085/ #CSAF https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-085.json

#OT #Advisory VDE-2026-081 Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities Weidmueller security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities (CVE-2026-14167, CVE-2026-14168, CVE-2026-14169, CVE-2026-14171, CVE-2026-2291, CVE-2026-4893, CVE-2026-5172, CVE-2026-40510, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796) in firmware releases prior to V2.3.0 authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware V2.3.0. #CVE CVE-2026-14168, CVE-2026-14167, CVE-2026-14169, CVE-2025-69421, CVE-2025-69420, CVE-2025-69419, CVE-2026-5172, CVE-2026-2291, CVE-2026-14171, CVE-2026-22795, CVE-2026-22796, CVE-2026-4893, CVE-2025-68160, CVE-2025-69418, CVE-2026-40510 https://certvde.com/en/advisories/vde-2026-081/ #CSAF https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-081.json

#OT #Advisory VDE-2026-076 ads-tec Industrial IT: Multiple Vulnerabilities in ADS-TEC IRF Products The ADS-TEC IRF1000 and IRF3000 products are affected by multiple vulnerabilities in firmware releases prior to 2.3.0: authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware 2.3.0. #CVE CVE-2026-14168, CVE-2026-14167, CVE-2026-14169, CVE-2025-69421, CVE-2025-69420, CVE-2025-69419, CVE-2026-5172, CVE-2026-2291, CVE-2026-14171, CVE-2026-22795, CVE-2026-22796, CVE-2026-4893, CVE-2025-68160, CVE-2025-69418, CVE-2026-40510 https://certvde.com/en/advisories/vde-2026-076/ #CSAF https://ads-tec-iit.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-076.json

#OT #Advisory VDE-2026-077 Lenze: Incorrect signature validation in the enable SSH routine The affected products belong to the Controller or Servo Drive product family and contain a vulnerability in a security-critical activation mechanism for service access. The signature verification of a file used for SSH activation can be compromised, which could allow unauthorized access to the device. #CVE CVE-2026-14837 https://certvde.com/en/advisories/vde-2026-077/ #CSAF https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-077.json

282,000+ VEX records are now in Vulnerability-Lookup 🎉 🔎 https://vulnerability.circl.lu/vex SUSE just joined Red Hat and Microsoft as a VEX source — so from any CVE you can see whether a vendor says a product is affected, fixed, or not affected. VEX statements are attached directly to each vulnerability and available via the open API. 🧑‍💻 https://github.com/vulnerability-lookup/vulnerability-lookup #VEX #CSAF #VulnerabilityManagement #OpenSource #InfoSec #GCVE #CVE #CYberSecurity #Vulnerability

#OT #Advisory VDE-2026-031 WAGO: Early-Boot Diagnostic Exposure in WAGO System I/O Field Devices Certain devices in the WAGO System I/O Field series enable an internal diagnostic capability during the initial stages of system startup. This behavior, which is not part of the publicly documented feature set, briefly allows access to system functions before the main operating environment becomes fully active. Under specific conditions, this could permit interactions with system components that are normally protected during regular operation. #CVE CVE-2026-4769 https://certvde.com/en/advisories/vde-2026-031/ #CSAF https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-031.json

🆕 Vulnerability-Lookup now imports Microsoft CSAF VEX documents from MSRC — joining the Red Hat VEX feed as a vendor VEX enrichment source. Per-CVE VEX statements (product status, severity) are attached directly to CVE records, visible on the vulnerability page and via the API with the full CSAF documents. Example with both Red Hat and Microsoft VEX: https://vulnerability.circl.lu/vuln/CVE-2026-53359#vex #VEX #CSAF #VulnerabilityManagement #CVE #OpenSource

👉 Ihr folgt uns als BSI hier im Fediverse und wollt keine IT-Sicherheitsmitteilung unseres CERT-Bund, dem Computer Emergency Response Team für Bundesbehörden, verpassen? Dann folgt auch @certbund@social.bund.de, der zentralen Anlaufstelle für präventive und reaktive Maßnahmen bei sicherheitsrelevanten Vorfällen in Computer-Systemen. CERT-Bund ist Mitglied des #CSIRTsNetwork der EU und ein starker Unterstützer des Common Security Advisory Framework #CSAF. Gern weitersagen! 🔄